-
Notifications
You must be signed in to change notification settings - Fork 24
Adding a '+' to the phone number before hashing should be mandatory, not optional #65
Copy link
Copy link
Closed
Description
Problem description
Phone number optionally prefixed with '+' before hashing? Why is this an option?
NumberVerificationRequestBody:
...
hashedPhoneNumber:
description: Hashed phone number. SHA-256 (in hexadecimal representation) of the mobile phone number in **E.164 format (starting with country code)**. Optionally prefixed with '+'.
This means that the supplied hashed phone number must be compared to two hashes of the true phone number to determine if they match. Some have claimed this is a "feature" for those who cannot read a specification or format phone numbers properly, but I think this is a bug that increases implementation complexity and processing time.
Expected behaviour
Adding '+' before hashing should be mandatory
NumberVerificationRequestBody:
...
hashedPhoneNumber:
description: Hashed phone number. SHA-256 (in hexadecimal representation) of the mobile phone number in **E.164 format (starting with country code and mandatorily prefixed by '+')**
Alternative solution
Remove option for hashing completely. It adds no data security for such a small plaintext space.
Additional context
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels